/setup-rate-limiting

Setup Rate Limiting

Implement API rate limiting

Instructions

1. **Rate Limiting Strategy and Planning**

• Analyze API endpoints and traffic patterns
• Define rate limiting policies for different user types and endpoints
• Plan for distributed rate limiting across multiple servers
• Consider different rate limiting algorithms (token bucket, sliding window, etc.)
• Design rate limiting bypass mechanisms for trusted clients

2. **Express.js Rate Limiting Implementation**

• Set up comprehensive rate limiting middleware:

**Basic Rate Limiting Setup:**

   // middleware/rate-limiter.js
   const rateLimit = require('express-rate-limit');
   const RedisStore = require('rate-limit-redis');
   const Redis = require('ioredis');

   class RateLimiter {
     constructor() {
       this.redis = new Redis(process.env.REDIS_URL);
       this.setupDefaultLimiters();
     }

     setupDefaultLimiters() {
       // General API rate limiter
       this.generalLimiter = rateLimit({
         store: new RedisStore({
           sendCommand: (...args) => this.redis.call(...args),
         }),
         windowMs: 15 * 60 * 1000, // 15 minutes
         max: 1000, // Limit each IP to 1000 requests per windowMs
         message: {
           error: 'Too many requests from this IP',
           retryAfter: '15 minutes'
         },
         standardHeaders: true,
         legacyHeaders: false,
         keyGenerator: (req) => {
           // Use user ID if authenticated, otherwise IP
           return req.user?.id || req.ip;
         },
         skip: (req) => {
           // Skip rate limiting for internal requests
           return req.headers['x-internal-request'] === 'true';
         },
         onLimitReached: (req, res, options) => {
           console.warn('Rate limit reached:', {
             ip: req.ip,
             userAgent: req.get('User-Agent'),
             endpoint: req.path,
             timestamp: new Date().toISOString()
           });
         }
       });

       // Strict limiter for sensitive endpoints
       this.strictLimiter = rateLimit({
         store: new RedisStore({
           sendCommand: (...args) => this.redis.call(...args),
         }),
         windowMs: 60 * 60 * 1000, // 1 hour
         max: 5, // Very strict limit
         message: {
           error: 'Too many attempts for this sensitive operation',
           retryAfter: '1 hour'
         },
         skipSuccessfulRequests: true,
         keyGenerator: (req) => `${req.user?.id || req.ip}:${req.path}`
       });

       // Authentication rate limiter
       this.authLimiter = rateLimit({
         store: new RedisStore({
           sendCommand: (...args) => this.redis.call(...args),
         }),
         windowMs: 15 * 60 * 1000, // 15 minutes
         max: 5, // Limit login attempts
         skipSuccessfulRequests: true,
         keyGenerator: (req) => `auth:${req.ip}:${req.body.email || req.body.username}`,
         message: {
           error: 'Too many authentication attempts',
           retryAfter: '15 minutes'
         }
       });
     }

     // Dynamic rate limiter based on user tier
     createTierBasedLimiter(windowMs = 15 * 60 * 1000) {
       return rateLimit({
         store: new RedisStore({
           sendCommand: (...args) => this.redis.call(...args),
         }),
         windowMs,
         max: (req) => {
           const user = req.user;
           if (!user) return 100; // Anonymous users
           
           switch (user.tier) {
             case 'premium': return 10000;
             case 'pro': return 5000;
             case 'basic': return 1000;
             default: return 500;
           }
         },
         keyGenerator: (req) => `tier:${req.user?.id || req.ip}`,
         message: (req) => ({
           error: 'Rate limit exceeded for your tier',
           currentTier: req.user?.tier || 'anonymous',
           upgradeUrl: '/upgrade'
         })
       });
     }

     // Endpoint-specific rate limiter
     createEndpointLimiter(endpoint, config) {
       return rateLimit({
         store: new RedisStore({
           sendCommand: (...args) => this.redis.call(...args),
         }),
         windowMs: config.windowMs || 60 * 1000,
         max: config.max || 100,
         keyGenerator: (req) => `endpoint:${endpoint}:${req.user?.id || req.ip}`,
         message: {
           error: `Rate limit exceeded for ${endpoint}`,
           limit: config.max,
           window: config.windowMs
         },
         ...config
       });
     }
   }

   module.exports = new RateLimiter();

3. **Advanced Rate Limiting Algorithms**

• Implement sophisticated rate limiting strategies:

**Token Bucket Implementation:**

   // rate-limiters/token-bucket.js
   class TokenBucket {
     constructor(capacity, refillRate, refillPeriod = 1000) {
       this.capacity = capacity;
       this.tokens = capacity;
       this.refillRate = refillRate;
       this.refillPeriod = refillPeriod;
       this.lastRefill = Date.now();
     }

     consume(tokens = 1) {
       this.refill();
       
       if (this.tokens >= tokens) {
         this.tokens -= tokens;
         return true;
       }
       
       return false;
     }

     refill() {
       const now = Date.now();
       const timePassed = now - this.lastRefill;
       const tokensToAdd = Math.floor(timePassed / this.refillPeriod) * this.refillRate;
       
       this.tokens = Math.min(this.capacity, this.tokens + tokensToAdd);
       this.lastRefill = now;
     }

     getAvailableTokens() {
       this.refill();
       return this.tokens;
     }

     getTimeToNextToken() {
       if (this.tokens > 0) return 0;
       
       const timeSinceLastRefill = Date.now() - this.lastRefill;
       return this.refillPeriod - (timeSinceLastRefill % this.refillPeriod);
     }
   }

   // Redis-backed token bucket for distributed systems
   class DistributedTokenBucket {
     constructor(redis, key, capacity, refil